[gnumeric] xml: plug leak.

[Morten Welinder <mortenw src gnome org>]

commit 7a89741d9ba954ecb8b3c2fdc7016513c497db12
Author: Morten Welinder <terra gnome org>
Date:   Tue Apr 28 12:48:34 2015 -0400

    xml: plug leak.

 ChangeLog          |    5 +++++
 NEWS               |    1 +
 src/xml-sax-read.c |   15 +++++++++++++++
 3 files changed, 21 insertions(+), 0 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index 66926ef..aec0d70 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2015-04-28  Morten Welinder  <terra gnome org>
+
+       * src/xml-sax-read.c (read_file_free_state): Plug leaks related to
+       malformed documents.  Fixes #748596.
+
 2015-04-16  Morten Welinder <terra gnome org>
 
        * configure.ac: Post-release bump.
diff --git a/NEWS b/NEWS
index 347bd1d..f89dc15 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ Morten:
        * Fix export of rotated axis labels.
        * Fix xlsx save crash related to shared strings.  [#748477]
        * Solver code refactoring.
+       * Plug leaks.
 
 --------------------------------------------------------------------------
 Gnumeric 1.12.22
diff --git a/src/xml-sax-read.c b/src/xml-sax-read.c
index d2c7003..468774d 100644
--- a/src/xml-sax-read.c
+++ b/src/xml-sax-read.c
@@ -3302,11 +3302,26 @@ read_file_free_state (XMLSaxParseState *state, gboolean self)
        gnm_conventions_unref (state->convs);
        state->convs = NULL;
 
+       /*
+        * Malformed documents can cause the parser to exit early.
+        * This cleans up various bits that may be left.
+        */
+
        if (state->style) {
                gnm_style_unref (state->style);
                state->style = NULL;
        }
 
+       if (state->cond_save_style) {
+               gnm_style_unref (state->cond_save_style);
+               state->cond_save_style = NULL;
+       }
+
+       if (state->cond) {
+               gnm_style_cond_free (state->cond);
+               state->cond = NULL;
+       }
+
        if (state->style_handler_doc) {
                gsf_xml_in_doc_free (state->style_handler_doc);
                state->style_handler_doc = NULL;